crackerjack 0.37.9__py3-none-any.whl → 0.45.2__py3-none-any.whl

crackerjack/services/patterns/security/code_injection.py

@@ -0,0 +1,122 @@
+"""Code injection detection patterns for SQL, Python, and system commands.
+
+This module contains patterns for detecting SQL injection, code evaluation
+injection, dynamic code execution, and system command injection attacks.
+"""
+
+import re
+
+from ..core import ValidatedPattern
+
+PATTERNS: dict[str, ValidatedPattern] = {
+    "validate_code_compilation": ValidatedPattern(
+        name="validate_code_compilation",
+        pattern=r"\bcompile\s*\(|code\.compile",
+        replacement="[CODE_COMPILE]",
+        description="Detect code compilation patterns for injection",
+        global_replace=True,
+        test_cases=[
+            ("compile(source)", "[CODE_COMPILE]source)"),
+            ("code.compile(source)", "[CODE_COMPILE](source)"),
+            ("compiled", "compiled"),
+        ],
+    ),
+    "validate_code_dynamic_access": ValidatedPattern(
+        name="validate_code_dynamic_access",
+        pattern=r"\b(__import__|getattr|setattr|delattr)\b",
+        replacement="[DYNAMIC_ACCESS]",
+        description="Detect dynamic attribute access patterns for code injection",
+        global_replace=True,
+        test_cases=[
+            ("__import__", "[DYNAMIC_ACCESS]"),
+            ("getattr(obj, name)", "[DYNAMIC_ACCESS](obj, name)"),
+            ("setattr(obj, name)", "[DYNAMIC_ACCESS](obj, name)"),
+            ("delattr(obj, name)", "[DYNAMIC_ACCESS](obj, name)"),
+            ("mygetattr", "mygetattr"),
+        ],
+    ),
+    "validate_code_eval_injection": ValidatedPattern(
+        name="validate_code_eval_injection",
+        pattern=r"\b(eval|exec|execfile)\s*\(",
+        replacement="[CODE_EVAL](",
+        description="Detect Python code evaluation injection patterns",
+        global_replace=True,
+        test_cases=[
+            ("eval(code)", "[CODE_EVAL](code)"),
+            ("exec(command)", "[CODE_EVAL](command)"),
+            ("execfile(script)", "[CODE_EVAL](script)"),
+            ("evaluate()", "evaluate()"),
+        ],
+    ),
+    "validate_code_system_commands": ValidatedPattern(
+        name="validate_code_system_commands",
+        pattern=r"\b(subprocess|os\.system|os\.popen|commands\.)",
+        replacement="[SYSTEM_COMMAND]",
+        description="Detect system command execution patterns for code injection",
+        global_replace=True,
+        test_cases=[
+            ("subprocess.run", "[SYSTEM_COMMAND].run"),
+            ("os.system(cmd)", "[SYSTEM_COMMAND](cmd)"),
+            ("os.popen(cmd)", "[SYSTEM_COMMAND](cmd)"),
+            ("commands.getoutput", "[SYSTEM_COMMAND]getoutput"),
+            ("mysubprocess", "mysubprocess"),
+        ],
+    ),
+    "validate_sql_boolean_injection": ValidatedPattern(
+        name="validate_sql_boolean_injection",
+        pattern=r"\b(or|and)\b.*=",
+        replacement="[BOOLEAN_INJECTION]",
+        flags=re.IGNORECASE,
+        description="Detect boolean-based SQL injection patterns (case insensitive)",
+        global_replace=True,
+        test_cases=[
+            ("or 1=1", "[BOOLEAN_INJECTION]1"),
+            ("AND password=", "[BOOLEAN_INJECTION]"),
+            ("normal or text", "normal or text"),
+            ("value=test", "value=test"),
+        ],
+    ),
+    "validate_sql_comment_patterns": ValidatedPattern(
+        name="validate_sql_comment_patterns",
+        pattern=r"(-{2,}|\/\*|\*\/)",
+        replacement="[SQL_COMMENT]",
+        description="Detect SQL comment patterns in input validation",
+        global_replace=True,
+        test_cases=[
+            ("--comment", "[SQL_COMMENT]comment"),
+            ("/* comment */", "[SQL_COMMENT] comment [SQL_COMMENT]"),
+            ("normal-text", "normal-text"),
+            ("---triple", "[SQL_COMMENT]triple"),
+        ],
+    ),
+    "validate_sql_injection_patterns": ValidatedPattern(
+        name="validate_sql_injection_patterns",
+        pattern=r"\b(union|select|insert|update|delete|drop|create|alter|"
+        r"exec|execute)\b",
+        replacement="[SQL_INJECTION]",
+        flags=re.IGNORECASE,
+        description="Detect SQL injection patterns in input validation "
+        "(case insensitive)",
+        global_replace=True,
+        test_cases=[
+            ("UNION SELECT", "[SQL_INJECTION] [SQL_INJECTION]"),
+            ("drop table", "[SQL_INJECTION] table"),
+            ("normal text", "normal text"),
+            ("exec command", "[SQL_INJECTION] command"),
+            ("execute procedure", "[SQL_INJECTION] procedure"),
+        ],
+    ),
+    "validate_sql_server_specific": ValidatedPattern(
+        name="validate_sql_server_specific",
+        pattern=r"\b(xp_cmdshell|sp_executesql)\b",
+        replacement="[SQLSERVER_EXPLOIT]",
+        flags=re.IGNORECASE,
+        description="Detect SQL Server specific attack patterns (case insensitive)",
+        global_replace=True,
+        test_cases=[
+            ("xp_cmdshell", "[SQLSERVER_EXPLOIT]"),
+            ("SP_EXECUTESQL", "[SQLSERVER_EXPLOIT]"),
+            ("normal text", "normal text"),
+        ],
+    ),
+}

crackerjack/services/patterns/security/credentials.py

@@ -0,0 +1,190 @@
+"""Credential and secret detection patterns for security validation.
+
+This module contains patterns for detecting and masking hardcoded credentials,
+secrets, tokens, and other sensitive authentication data in code.
+"""
+
+import re
+
+from ..core import ValidatedPattern
+
+PATTERNS: dict[str, ValidatedPattern] = {
+    "detect_hardcoded_credentials_advanced": ValidatedPattern(
+        name="detect_hardcoded_credentials_advanced",
+        pattern=r"(?i)\b(?:password|passwd|pwd|secret|key|token|api_key|"
+        r'apikey)\s*[:=]\s*["\'][^"\']{3,}["\']',
+        replacement="[HARDCODED_CREDENTIAL_DETECTED]",
+        description="Detect hardcoded credentials in various formats "
+        "(case insensitive)",
+        flags=re.IGNORECASE,
+        global_replace=True,
+        test_cases=[
+            ('password="secret123"', "[HARDCODED_CREDENTIAL_DETECTED]"),
+            ("API_KEY = 'abc-123-def'", "[HARDCODED_CREDENTIAL_DETECTED]"),
+            ('token: "my-secret-token"', "[HARDCODED_CREDENTIAL_DETECTED]"),
+            (
+                'username = "user"',
+                'username = "user"',
+            ),
+        ],
+    ),
+    "detect_hardcoded_secrets": ValidatedPattern(
+        name="detect_hardcoded_secrets",
+        pattern=r'\b\w*(password|secret|key|token)\w*\s*=\s*[\'"][^\'"]+[\'"]',
+        replacement="[SECRET_DETECTED]",
+        description="Detect hardcoded secrets in assignments (case insensitive)",
+        flags=re.IGNORECASE,
+        global_replace=True,
+        test_cases=[
+            ('password = "secret123"', "[SECRET_DETECTED]"),
+            ("api_key = 'abc123def'", "[SECRET_DETECTED]"),
+            ('TOKEN = "my-token-here"', "[SECRET_DETECTED]"),
+            ("username = 'user123'", "username = 'user123'"),
+        ],
+    ),
+    "fix_hardcoded_jwt_secret": ValidatedPattern(
+        name="fix_hardcoded_jwt_secret",
+        pattern=r'(JWT_SECRET|jwt_secret)\s*=\s*["\'][^"\']+["\']',
+        replacement=r'\1 = os.getenv("JWT_SECRET", "")',
+        description="Replace hardcoded JWT secrets with environment variables",
+        global_replace=True,
+        test_cases=[
+            (
+                'JWT_SECRET = "hardcoded-secret"',
+                'JWT_SECRET = os.getenv("JWT_SECRET", "")',
+            ),
+            ('jwt_secret = "my-secret"', 'jwt_secret = os.getenv("JWT_SECRET", "")'),
+            ('other_var = "value"', 'other_var = "value"'),
+        ],
+    ),
+    "mask_generic_long_token": ValidatedPattern(
+        name="mask_generic_long_token",
+        pattern=r"\b[a-zA-Z0-9_-]{32,}\b",
+        replacement="****",
+        description="Mask generic long tokens (32+ chars, word boundaries to avoid"
+        " false positives)",
+        global_replace=True,
+        test_cases=[
+            ("secret_key=abcdef1234567890abcdef1234567890abcdef", "secret_key=****"),
+            (
+                "Short token abc123def456",
+                "Short token abc123def456",
+            ),
+            (
+                "File path "
+                "/very/long/path/that/should/not/be/masked/even/though/its/long",
+                "File path "
+                "/very/long/path/that/should/not/be/masked/even/though/its/long",
+            ),
+            ("API_KEY=verylongapikeyhere1234567890123456", "API_KEY=****"),
+            (
+                "Long-token_with-underscores_123456789012345678",
+                "****",
+            ),
+        ],
+    ),
+    "mask_github_token": ValidatedPattern(
+        name="mask_github_token",
+        pattern=r"\bghp_[a-zA-Z0-9]{8,}\b",  # Adjusted to support varying token lengths (at least 8 chars after ghp_)
+        replacement="ghp_****",
+        description="Mask GitHub personal access tokens (variable length after ghp_"
+        " with word boundaries)",
+        global_replace=True,
+        test_cases=[
+            ("ghp_1234567890abcdef1234567890abcdef1234", "ghp_****"),
+            (
+                "GITHUB_TOKEN=ghp_1234567890abcdefghij",  # Updated to support the test token format
+                "GITHUB_TOKEN=ghp_****",
+            ),
+            ("ghp_short", "ghp_short"),
+            (
+                "ghp_1234567890abcdef1234567890abcdef12345",
+                "ghp_****",
+            ),
+            (
+                "Multiple ghp_1234567890abcdef1234567890abcdef1234 and"
+                " ghp_abcdef1234567890abcdef12345678901234",
+                "Multiple ghp_**** and ghp_****",
+            ),
+        ],
+    ),
+    "mask_password_assignment": ValidatedPattern(
+        name="mask_password_assignment",
+        pattern=r"(?i)\b(password\s*[=: ]\s*)['\"]([^'\"]{8,})['\"]",
+        replacement=r"\1'****'",
+        description="Mask password assignments in various formats (case insensitive)",
+        global_replace=True,
+        test_cases=[
+            ('password="secret123456"', "password='****'"),
+            ("password='my_long_password'", "password='****'"),
+            ('password: "another_secret_password"', "password: '****'"),
+            ("password = 'spaced_password_assignment'", "password = '****'"),
+            ('password="short"', 'password="short"'),
+            (
+                "not_password='should_not_be_masked'",
+                "not_password='should_not_be_masked'",
+            ),
+            ('PASSWORD="UPPERCASE_PASSWORD"', "PASSWORD='****'"),
+        ],
+    ),
+    "mask_pypi_token": ValidatedPattern(
+        name="mask_pypi_token",
+        pattern=r"\bpypi-[a-zA-Z0-9_-]{12,}\b",
+        replacement="pypi-****",
+        description="Mask PyPI authentication tokens (word boundaries to prevent"
+        " false matches)",
+        global_replace=True,
+        test_cases=[
+            ("pypi-AgEIcHlwaS5vcmcCJGE4M2Y3ZjI", "pypi-****"),
+            (
+                "Using token: pypi-AgEIcHlwaS5vcmcCJGE4M2Y3ZjI for upload",
+                "Using token: pypi-**** for upload",
+            ),
+            ("pypi-short", "pypi-short"),
+            (
+                "not pypi-AgEIcHlwaS5vcmcCJGE4M2Y3ZjI",
+                "not pypi-****",
+            ),
+            (
+                "Multiple pypi-token1234567890 and pypi-anothertokenhere",
+                "Multiple pypi-**** and pypi-****",
+            ),
+        ],
+    ),
+    "mask_token_assignment": ValidatedPattern(
+        name="mask_token_assignment",
+        pattern=r"(?i)\b(token\s*[=: ]\s*)['\"]([^'\"]{8,})['\"]",
+        replacement=r"\1'****'",
+        description="Mask token assignments in various formats (case insensitive)",
+        global_replace=True,
+        test_cases=[
+            ('token="abc123def456789"', "token='****'"),
+            ("token='long_secret_token_here'", "token='****'"),
+            ('token: "another_secret_token"', "token: '****'"),
+            ("token = 'spaced_assignment_token'", "token = '****'"),
+            ('token="short"', 'token="short"'),
+            (
+                "not_token='should_not_be_masked'",
+                "not_token='should_not_be_masked'",
+            ),
+            ('TOKEN="UPPERCASE_TOKEN_HERE"', "TOKEN='****'"),
+        ],
+    ),
+    "remove_debug_prints_with_secrets": ValidatedPattern(
+        name="remove_debug_prints_with_secrets",
+        pattern=r"print\s*\([^)]*(?: password|secret|key|token)[^)]*\)",
+        replacement="",
+        description="Remove debug print statements that contain sensitive information",
+        global_replace=True,
+        test_cases=[
+            ('print("password: ", password)', ""),
+            ("print(f'Token: {token}')", ""),
+            ("print('Debug secret value')", ""),
+            (
+                "print('Normal debug message')",
+                "print('Normal debug message')",
+            ),
+            ('print("API key is", key)', ""),
+        ],
+    ),
+}

crackerjack/services/patterns/security/path_traversal.py

@@ -0,0 +1,221 @@
+"""Path traversal and directory access detection patterns.
+
+This module contains patterns for detecting directory traversal attacks,
+suspicious file path patterns, and unauthorized directory access attempts.
+"""
+
+from ..core import ValidatedPattern
+
+PATTERNS: dict[str, ValidatedPattern] = {
+    "detect_directory_traversal_basic": ValidatedPattern(
+        name="detect_directory_traversal_basic",
+        pattern=r"\.\./",
+        replacement="[TRAVERSAL]",
+        description="Detect basic directory traversal patterns (../)",
+        global_replace=True,
+        test_cases=[
+            ("../config.txt", "[TRAVERSAL]config.txt"),
+            ("normal/path", "normal/path"),
+            ("../../etc/passwd", "[TRAVERSAL][TRAVERSAL]etc/passwd"),
+        ],
+    ),
+    "detect_directory_traversal_backslash": ValidatedPattern(
+        name="detect_directory_traversal_backslash",
+        pattern=r"\.\.[/\\]",
+        replacement="[TRAVERSAL]",
+        description="Detect directory traversal with forward/back slashes",
+        global_replace=True,
+        test_cases=[
+            ("..\\config.txt", "[TRAVERSAL]config.txt"),
+            ("../config.txt", "[TRAVERSAL]config.txt"),
+            ("normal/path", "normal/path"),
+        ],
+    ),
+    "detect_url_encoded_traversal": ValidatedPattern(
+        name="detect_url_encoded_traversal",
+        pattern=r"%2e%2e%2f",
+        replacement="[TRAVERSAL]",
+        description="Detect URL encoded directory traversal (%2e%2e%2f = ../)",
+        global_replace=True,
+        test_cases=[
+            ("path/%2e%2e%2f/config", "path/[TRAVERSAL]/config"),
+            ("normal/path", "normal/path"),
+            ("%2e%2e%2fpasswd", "[TRAVERSAL]passwd"),
+        ],
+    ),
+    "detect_double_url_encoded_traversal": ValidatedPattern(
+        name="detect_double_url_encoded_traversal",
+        pattern=r"%252e%252e%252f",
+        replacement="[TRAVERSAL]",
+        description="Detect double URL encoded directory traversal",
+        global_replace=True,
+        test_cases=[
+            ("path/%252e%252e%252f/config", "path/[TRAVERSAL]/config"),
+            ("normal/path", "normal/path"),
+        ],
+    ),
+    "detect_null_bytes_url": ValidatedPattern(
+        name="detect_null_bytes_url",
+        pattern=r"%00",
+        replacement="[NULL]",
+        description="Detect URL encoded null bytes",
+        global_replace=True,
+        test_cases=[
+            ("file.txt%00.jpg", "file.txt[NULL].jpg"),
+            ("normal.txt", "normal.txt"),
+        ],
+    ),
+    "detect_null_bytes_literal": ValidatedPattern(
+        name="detect_null_bytes_literal",
+        pattern=r"\\x00",
+        replacement="[NULL]",
+        description="Detect literal null byte patterns",
+        global_replace=True,
+        test_cases=[
+            ("file.txt\\x00", "file.txt[NULL]"),
+            ("normal.txt", "normal.txt"),
+        ],
+    ),
+    "detect_utf8_overlong_null": ValidatedPattern(
+        name="detect_utf8_overlong_null",
+        pattern=r"%c0%80",
+        replacement="[NULL]",
+        description="Detect UTF-8 overlong null byte encoding",
+        global_replace=True,
+        test_cases=[
+            ("file.txt%c0%80", "file.txt[NULL]"),
+            ("normal.txt", "normal.txt"),
+        ],
+    ),
+    "detect_sys_directory_pattern": ValidatedPattern(
+        name="detect_sys_directory_pattern",
+        pattern=r"^/sys/?.*",
+        replacement="[DANGER]",
+        description="Detect access to /sys directory",
+        test_cases=[
+            ("/sys/", "[DANGER]"),
+            ("/sys/devices", "[DANGER]"),
+            ("/usr/sys", "/usr/sys"),
+        ],
+    ),
+    "detect_proc_directory_pattern": ValidatedPattern(
+        name="detect_proc_directory_pattern",
+        pattern=r"^/proc/?.*",
+        replacement="[DANGER]",
+        description="Detect access to /proc directory",
+        test_cases=[
+            ("/proc/", "[DANGER]"),
+            ("/proc/self", "[DANGER]"),
+            ("/usr/proc", "/usr/proc"),
+        ],
+    ),
+    "detect_etc_directory_pattern": ValidatedPattern(
+        name="detect_etc_directory_pattern",
+        pattern=r"^/etc/?.*",
+        replacement="[DANGER]",
+        description="Detect access to /etc directory",
+        test_cases=[
+            ("/etc/", "[DANGER]"),
+            ("/etc/passwd", "[DANGER]"),
+            ("/usr/etc", "/usr/etc"),
+        ],
+    ),
+    "detect_boot_directory_pattern": ValidatedPattern(
+        name="detect_boot_directory_pattern",
+        pattern=r"^/boot/?.*",
+        replacement="[DANGER]",
+        description="Detect access to /boot directory",
+        test_cases=[
+            ("/boot/", "[DANGER]"),
+            ("/boot/grub", "[DANGER]"),
+            ("/usr/boot", "/usr/boot"),
+        ],
+    ),
+    "detect_dev_directory_pattern": ValidatedPattern(
+        name="detect_dev_directory_pattern",
+        pattern=r"^/dev/?.*",
+        replacement="[DANGER]",
+        description="Detect access to /dev directory",
+        test_cases=[
+            ("/dev/", "[DANGER]"),
+            ("/dev/null", "[DANGER]"),
+            ("/usr/dev", "/usr/dev"),
+        ],
+    ),
+    "detect_root_directory_pattern": ValidatedPattern(
+        name="detect_root_directory_pattern",
+        pattern=r"^/root/?.*",
+        replacement="[DANGER]",
+        description="Detect access to /root directory",
+        test_cases=[
+            ("/root/", "[DANGER]"),
+            ("/root/.ssh", "[DANGER]"),
+            ("/usr/root", "/usr/root"),
+        ],
+    ),
+    "detect_var_log_directory_pattern": ValidatedPattern(
+        name="detect_var_log_directory_pattern",
+        pattern=r"^/var/log/?.*",
+        replacement="[DANGER]",
+        description="Detect access to /var/log directory",
+        test_cases=[
+            ("/var/log/", "[DANGER]"),
+            ("/var/log/messages", "[DANGER]"),
+            ("/usr/var/log", "/usr/var/log"),
+        ],
+    ),
+    "detect_bin_directory_pattern": ValidatedPattern(
+        name="detect_bin_directory_pattern",
+        pattern=r"^/(usr/)?bin/?.*",
+        replacement="[DANGER]",
+        description="Detect access to /bin or /usr/bin directories",
+        test_cases=[
+            ("/bin/", "[DANGER]"),
+            ("/usr/bin/", "[DANGER]"),
+            ("/usr/local/bin", "/usr/local/bin"),
+        ],
+    ),
+    "detect_sbin_directory_pattern": ValidatedPattern(
+        name="detect_sbin_directory_pattern",
+        pattern=r"^/(usr/)?sbin/?.*",
+        replacement="[DANGER]",
+        description="Detect access to /sbin or /usr/sbin directories",
+        test_cases=[
+            ("/sbin/", "[DANGER]"),
+            ("/usr/sbin/", "[DANGER]"),
+            ("/usr/local/sbin", "/usr/local/sbin"),
+        ],
+    ),
+    "detect_parent_directory_in_path": ValidatedPattern(
+        name="detect_parent_directory_in_path",
+        pattern=r"\.\.",
+        replacement="[PARENT]",
+        description="Detect parent directory references anywhere in path",
+        global_replace=True,
+        test_cases=[
+            ("../config", "[PARENT]/config"),
+            ("safe/path", "safe/path"),
+            ("path/../other", "path/[PARENT]/other"),
+        ],
+    ),
+    "detect_suspicious_temp_traversal": ValidatedPattern(
+        name="detect_suspicious_temp_traversal",
+        pattern=r"/tmp/.*\.\./",  # nosec B108
+        replacement="[SUSPICIOUS]",
+        description="Detect traversal attempts in temp directories",
+        test_cases=[
+            ("/tmp/safe/../etc/passwd", "[SUSPICIOUS]etc/passwd"),  # nosec B108
+            ("/tmp/normal/file.txt", "/tmp/normal/file.txt"),  # nosec B108
+        ],
+    ),
+    "detect_suspicious_var_traversal": ValidatedPattern(
+        name="detect_suspicious_var_traversal",
+        pattern=r"/var/.*\.\./",
+        replacement="[SUSPICIOUS]",
+        description="Detect traversal attempts in var directories",
+        test_cases=[
+            ("/var/lib/../etc/passwd", "[SUSPICIOUS]etc/passwd"),
+            ("/var/lib/normal.txt", "/var/lib/normal.txt"),
+        ],
+    ),
+}